A business applies for credit. You want the owner's personal credit report, because for a small operating company the owner's credit history is the more useful signal. The applicant is the entity, though, and the FCRA's permissible purposes are written around consumers.
This is one of the most commonly mishandled areas in small business and commercial lending, because the practice is universal while the documentation supporting it is often missing. The business purpose of the loan does not itself create a permissible purpose to pull a report on the individual behind it.
Key Takeaways:
- A business-purpose loan does not create permissible purpose for an owner's consumer report; the owner has to be a party to the transaction or give written authorization
- The most common violation is timing - pulling the owner's report during prospecting or prequalification, before any guaranty or written authorization exists
- Written instructions under 15 U.S.C. § 1681b(a)(2) are the cleanest basis and the easiest to evidence at scale
- Obtaining a report without permissible purpose carries statutory damages for willful conduct under § 1681n, independent of whether the applicant was harmed
Why a Business Loan Doesn't Automatically Create Permissible Purpose
Two definitions do the work here.
A consumer report under 15 U.S.C. § 1681a(d) is a communication bearing on a consumer's creditworthiness that is used or expected to be used as a factor in establishing the consumer's eligibility for credit to be used primarily for personal, family, or household purposes, along with employment and other listed purposes. A report on the business from a commercial bureau is generally not a consumer report. A report on the owner as an individual from a consumer reporting agency is.
The permissible purpose most lenders rely on is § 1681b(a)(3)(A), which allows furnishing a report to a person who intends to use it in connection with a credit transaction "involving the consumer on whom the information is to be furnished and involving the extension of credit to, or review or collection of an account of, the consumer."
Read that carefully. The credit transaction has to involve the consumer whose report you're pulling. When the borrower is an LLC and the owner has no personal obligation, the transaction involves the entity, not the individual. Nothing in the statute converts the owner into a party by virtue of ownership.
Under § 1681b(f), using or obtaining a consumer report without a permissible purpose is itself the violation. There is no harm requirement, and § 1681n provides statutory damages of $100 to $1,000 per willful violation plus potential punitive damages, with negligent violations covered by § 1681o. Obtaining a report under false pretenses can also carry criminal exposure under § 1681q.
The Three Routes That Do Establish Permissible Purpose
The Owner Is a Guarantor or Co-Obligor
When the owner personally guarantees the debt or signs as a co-obligor, the individual becomes a party to the credit transaction. The long-standing reading, reflected in FTC staff guidance on the FCRA, treats a guarantor as involved in the extension of credit for purposes of § 1681b(a)(3)(A).
The practical constraint is sequencing. The guaranty has to exist, or the individual has to have applied to be a guarantor, at the time you pull. A guaranty signed at closing does not retroactively authorize a report obtained six weeks earlier during underwriting.
Written Instructions of the Consumer
§ 1681b(a)(2) permits furnishing a report "in accordance with the written instructions of the consumer to whom it relates." This is the most reliable basis for business owner pulls, and the one worth defaulting to.
It is independent of whether the owner ends up guaranteeing anything, it works during prequalification, and it produces an artifact you can retain. The authorization should identify the individual, state that consumer reports may be obtained, and cover the intended scope - initial evaluation, and if applicable, renewals and ongoing account review.
Written instructions do not have to be on paper. An electronic authorization with a captured timestamp, IP address, and the exact text presented satisfies the requirement and is easier to produce years later than a signature buried in a loan file.
Account Review on an Existing Relationship
§ 1681b(a)(3)(F)(ii) permits obtaining a report to review an account to determine whether the consumer continues to meet the terms of the account. For annual reviews and renewals on facilities the owner guaranteed, this supports periodic pulls without new authorization each cycle - but it applies to the account the consumer is obligated on, not to unrelated exposure.
What Documentation Has to Show
| Scenario | Permissible purpose | Artifact to retain |
|---|---|---|
| Owner signs personal guaranty | § 1681b(a)(3)(A) | Executed guaranty or guarantor application dated on or before the pull |
| Prequalification before terms exist | § 1681b(a)(2) | Written authorization with timestamp and the text shown to the owner |
| Multiple owners, one guaranteeing | Per-individual basis | Separate authorization or guaranty for each individual pulled |
| Annual review of guaranteed facility | § 1681b(a)(3)(F)(ii) | Link between the pull and the specific account under review |
| Renewal or increase request | § 1681b(a)(2) or (a)(3)(A) | New authorization or existing guaranty covering the renewed obligation |
The test an examiner or plaintiff's counsel applies is per-inquiry: for this specific pull, on this specific individual, on this date, what was the basis? A program that can answer that in aggregate but not per record is not documented.
Where This Breaks at Scale
Prospecting pulls. A relationship manager runs an owner's credit to decide whether an opportunity is worth pursuing. No application, no authorization, no guaranty. This is the clearest violation pattern in the category and it rarely appears in a policy - it appears in bureau inquiry logs.
Multiple owners, one authorization. A business with four members submits an application signed by the managing member, and the lender pulls all four. Authorization is individual. One owner cannot consent on another's behalf.
Authorization scope drift. An authorization obtained for an initial application gets relied on three years later for an unrelated facility. If the text didn't cover ongoing review, the later pull needs its own basis.
Embedded and partner-originated flows. When applications arrive through an embedded form or a referral partner, the authorization text is often controlled by whoever built the form. If you're the party pulling the report, you own the sufficiency of that text and need to retain what the applicant actually saw - not just a flag that a box was checked.
Renewals on autopilot. Portfolio monitoring pulls run on a schedule against every guarantor, including individuals whose guaranteed facility has been paid off. Account review purpose ends when the account does.
The mechanics of retaining per-inquiry basis across high volumes are covered in managing FCRA permissible purpose documentation at scale.
Adverse Action When an Owner's Report Drives a Business Denial
Two notice regimes apply and they are frequently conflated.
FCRA § 1681m(a) requires an adverse action notice when adverse action is taken with respect to a consumer based in whole or in part on a consumer report, including the credit score used, the reporting agency's contact information, and the consumer's rights to a free report and to dispute. If you declined a guarantor, or declined the facility because of the owner's personal credit, the individual whose report you used should receive this notice. Sending it is inexpensive; litigating whether it was owed is not.
Regulation B treats business credit differently from consumer credit. 12 CFR § 1002.9(a)(3) sets modified notification requirements for business credit and distinguishes applicants with gross revenues of $1 million or less in the prior fiscal year from those above that threshold, with more flexibility - including oral notification and reasons on request - for the higher-revenue category.
The error to avoid is assuming that because Reg B relaxes notification for business credit, the FCRA notice also relaxes. It doesn't. The FCRA obligation attaches to the use of a consumer report on an individual, not to the purpose of the loan. For the mechanics of both notices, see adverse action notice requirements under ECOA and FCRA.
What the Bureaus Require of You
Under § 1681e(a), consumer reporting agencies must maintain reasonable procedures to limit furnishing reports to permissible purposes, and must require prospective users to identify themselves, certify the purposes for which the information is sought, and certify that it will be used for no other purpose.
That certification is why bureau onboarding involves end-user agreements, site inspections, and periodic recertification. Your certified purpose constrains what you can do afterward: certifying for consumer lending and then using the same access for commercial prospecting breaches the agreement and undermines the § 1681b(f) analysis. If your use cases change, the certification needs to change with them. Fintech-specific requirements are covered in FCRA compliance requirements for fintech lenders.
How Teams Document Permissible Purpose Without Slowing Underwriting
The programs that survive scrutiny share one design choice: permissible purpose is captured at the moment of the pull, as a required field, rather than reconstructed from loan files afterward. Each inquiry carries the individual, the date, the asserted basis, and a link to the artifact supporting it - the authorization text with its timestamp, or the guaranty. Exceptions surface as inquiries with no linked basis, which is a report someone can review weekly instead of a discovery exercise during an examination.
Canarie handles this as part of FCRA compliance execution, capturing the basis and evidence for each pull as work happens and flagging inquiries that lack one.
See how permissible purpose evidence is captured per inquiry →
Frequently Asked Questions
Can we pull a business owner's personal credit report for a business loan?
Yes, provided you have a permissible purpose tied to that individual. The three workable bases are that the owner is a guarantor or co-obligor on the transaction, that the owner gave written authorization under § 1681b(a)(2), or that you are reviewing an existing account the owner is obligated on. The business purpose of the loan does not by itself supply a permissible purpose for a report on the individual.
Does a personal guaranty need to be signed before we pull?
The individual needs to be a party to the credit transaction at the time of the pull, which includes having applied to be a guarantor. Pulling during early evaluation and obtaining the guaranty at closing leaves the earlier inquiry without a basis. If you need to pull before guaranty terms are settled, rely on written authorization instead.
Do we need separate authorization from each owner?
Yes. Authorization is personal to the individual whose report is obtained. One owner or officer cannot authorize a pull on another individual, even when that person signed the business's application. Collect authorization from each individual whose report you intend to obtain.
Is a commercial credit report on the business subject to the FCRA?
Generally no. Reports on a business entity from a commercial bureau typically fall outside the consumer report definition in § 1681a(d), so FCRA permissible purpose and adverse action rules don't attach. The moment you obtain a consumer reporting agency's report on an individual, they do.
Do we owe an FCRA adverse action notice if the applicant is a business?
If you took adverse action based in whole or in part on a consumer report about an individual, that individual should receive the § 1681m(a) notice - most clearly when a guarantor is declined or when the owner's personal credit drove the decision. Regulation B's modified business credit notification rules in 12 CFR § 1002.9(a)(3) address a separate obligation and do not displace the FCRA notice.
How long should we retain permissible purpose documentation?
Retain it for as long as the underlying credit relationship plus the applicable limitations period, and keep the authorization text itself rather than a reference to it. FCRA claims can be brought within two years of discovery of the violation, subject to a five-year outer limit under § 1681p, so a record showing only that consent was captured - without what was actually presented - is weak evidence years later.